Technical safeguards: access, audit, integrity, authentication, transmission

Granite City Family Dental — Policy set version 1.0 — Effective November 1, 2026 — Binder edition 2026

Authority: 45 CFR 164.312: access control (a), audit controls (b), integrity (c), person or entity authentication (d), transmission security (e).

Approved by Dr. Maria Lindqvist, Owner. Responsible officer: Janelle Okafor, Office Manager. Carried out by CRU Technologies under the Security Officer's direction.

Purpose

These are the controls configured on the systems of Granite City Family Dental: Open Dental (server in our office), Microsoft 365, the Windows network, remote access and the firewall. Each item below states what is in place today, from the practice's own answers, and what is required. Every gap is a risk-register item with an owner and a due date.

1. Access control

Authority: 45 CFR 164.312(a).

Unique user identification — 164.312(a)(2)(i), required

Every user has their own login on every system holding PHI. Accounts are never shared, and the user access list (document 14) names each one.

Emergency access procedure — 164.312(a)(2)(ii), required

The owner holds administrator credentials sealed in the safe; the IT provider can reset access on the Security Officer's recorded request. Any use is logged and reviewed.

Every emergency use is written in the incident log with the date, who used it and why, and the Security Officer reviews it within five business days. The sealed credentials are changed after each use.

Automatic logoff — 164.312(a)(2)(iii), addressable

Screens lock after 10 minutes of inactivity on every workstation, enforced by policy from the IT provider, and the EHR's own session timeout is set to the shortest value the vendor allows that does not disrupt care. Staff still lock the screen by hand when they walk away.

Encryption and decryption — 164.312(a)(2)(iv), addressable

Encryption at rest is the practice's chosen control for every device class; a lost encrypted device is not a reportable breach (document 22), a lost unencrypted one is.

Device class	Status today	Requirement
Laptops	No laptops	BitLocker or FileVault on every laptop, recovery keys escrowed by the IT provider
Desktops	Yes, all	BitLocker on every desktop that holds or caches PHI
Phones and tablets touching PHI	None touch PHI	Passcode and device encryption, remote wipe enabled
Servers	No	Encryption at rest on every volume holding ePHI
Backups	Yes	Encrypted in transit and at rest, keys held apart from the data

Servers: not encrypted at rest. Required control: encryption at rest on every server volume holding ePHI within 90 days, with recovery keys escrowed. Recorded in the risk register as "Unencrypted device — server", owner Janelle Okafor.

2. Audit controls

Authority: 45 CFR 164.312(b); information system activity review 164.308(a)(1)(ii)(D).

Audit logging is turned on for: EHR access log, Email sign-in log (M365 / Google), Windows event logs, Firewall log and Backup job log.

Review: CRU Technologies with Janelle Okafor reviews the logs monthly and records each review on the information-system activity review log (form below and in the registers appendix).

What the review looks for:

EHR: records opened by users who were not treating or billing that patient; access to records of staff, family members and public figures; access outside working hours; mass exports or prints.
Email: sign-ins from unexpected countries or devices; new forwarding rules; MFA changes; mass downloads.
Windows and remote access: failed sign-ins, new administrator accounts, sign-ins from departed users.
Firewall and backup: blocked attacks of note; backup job failures.

Anything unexplained is an incident under document 16. Logs are retained for at least 12 months, and six years where the system allows, so a complaint about an access that happened last year can still be answered.

Information-system activity review log (form)

Date of review	Logs reviewed	Period covered	Findings	Action taken / incident opened	Reviewer

3. Integrity

Authority: 45 CFR 164.312(c).

How Granite City Family Dental knows records have not been altered or lost:

EHR audit trail records every edit; backups are verified by the backup system and tested by restore; antivirus and patching protect against tampering.

The EHR audit trail records who created, edited or deleted each entry and keeps the prior version; staff never alter a signed note except by addendum.
Backups are verified by the backup system and proven by the annual restore test (document 17).
Endpoint protection (CRU Security Suite (managed ESET)) and patching (automatically by the it provider within 30 days) protect systems from tampering.
Paper forms entered into the EHR are checked by a second person or the provider before the paper is destroyed.

4. Person or entity authentication

Authority: 45 CFR 164.312(d).

Users prove who they are with a unique login, a password meeting the standard in document 15, and MFA. Status at the effective date: email Yes; EHR No; remote access Yes; administrator accounts Yes; method Authenticator app. The requirements and the risk-register entries for each missing control are in document 15, section 6, and are not repeated here.

Systems also authenticate each other: the backup agent, the EHR interface and any VPN use certificates or keys managed by the IT provider, never shared passwords.

5. Transmission security

Authority: 45 CFR 164.312(e).

Email

Method for PHI in email: Encrypted email feature (M365 / Google encryption).

Remote access and VPN

Remote access is only through the approved VPN or secure remote tool, on practice-managed encrypted devices, with MFA. Remote desktop ports are not opened to the internet.

Network and Wi-Fi

Firewall / gateway: UniFi Cloud Gateway Max, managed by CRU Technologies, kept on supported firmware, with inbound access denied by default.
Guest Wi-Fi: separate from the practice network; patients and visitors never join the staff network.- Staff Wi-Fi uses WPA2 or WPA3 with a password known only to the IT provider and the Security Officer; it is changed when a key holder leaves.

Text messaging

Rule: Appointment reminders only, no clinical content. Texts carry date, time and location of an appointment only: no diagnosis, test result, medication or billing detail. Patients may opt out.

Fax

Fax is used through Open Dental eFax (BAA signed). Numbers are confirmed before sending, a cover sheet with the confidentiality notice is used, speed-dial entries are checked quarterly, incoming faxes are collected at once, and a misdirected fax is an incident under document 16. An e-fax vendor is a business associate (document 19).

Telehealth

No telehealth platform is recorded. If telehealth is offered, the platform must encrypt sessions and sign a business associate agreement before first use.

6. Patching and malicious software protection

Patches: Automatically by the IT provider within 30 days.- Endpoint protection: CRU Security Suite (managed ESET) on every workstation, laptop and server, updating automatically and reporting to the IT provider; alerts are handled under document 16.
Unsupported operating systems and applications are retired or isolated; the IT provider lists any that remain in the risk register.

7. Enforcement

Disabling a control, turning off encryption or protection, opening a remote path or sharing an account is handled under the sanction policy (document 05).

Approval

Policy approved by: Dr. Maria Lindqvist, Owner Signature: ___________________________ Date: ______________

Security Officer: Janelle Okafor Signature: ___________________________ Date: ______________

IT provider acknowledgment (CRU Technologies): ___________________________ Date: ______________